CVE-2026-108718
Received Received - Intake

Authorization Code Grant Bypass in Rill Admin OAuth Server

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108718
EUVD
EUVD-2026-96992

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Rill Data rill 0.77.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization issue in Rill's admin OAuth server (versions 0.77.0 to 0.90.5). Attackers can register a malicious client with a special scope called long_lived_access_token. When a user visits a crafted authorization link, the server issues an authorization code without requiring user consent. This code is then exchanged for a non-expiring API token granting the attacker full access to the victim's account and data.

Detection Guidance

Check Rill admin server logs for unauthorized OAuth client registrations or suspicious authorization codes issued without user consent. Inspect network traffic for dynamic client registration requests to the admin OAuth server endpoint.

Impact Analysis

If you use Rill versions 0.77.0 to 0.90.5, an attacker could gain persistent access to your account, data, and permissions. They could create, modify, or delete projects, access sensitive information, and maintain control indefinitely since the token never expires. This could lead to data breaches, unauthorized changes, or complete account takeover.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA, which mandate strict access controls, user consent for data access, and mechanisms to revoke permissions. The lack of authorization and persistent unauthorized access could result in unauthorized data exposure, violating these standards and potentially leading to legal penalties or data breach notifications.

Mitigation Strategies
  • Upgrade Rill to a version beyond 0.90.5 where the vulnerability is patched.
  • Revoke all existing OAuth tokens, especially those with long-lived access tokens.
  • Audit and remove any unauthorized OAuth clients registered on the admin server.
  • Implement strict redirect URI validation and enforce user consent for authorization codes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108718. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart